Two mid‑August incidents involved a ransomware variant calling itself “Cephalus” that used RDP access to compromised accounts and leveraged MEGA for likely data exfiltration. The attackers deployed the ransomware via DLL sideloading of SentinelAgentCore.dll through a legitimate SentinelOne executable (SentinelBrowserNativeHost.exe) which then loaded a data.bin containing the ransomware, and the ransom notes linked to news articles and data proof hosted on GoFile to pressure victims. #Cephalus #SentinelBrowserNativeHost.exe
Keypoints
- Two separate mid‑August incidents involved a ransomware family identifying itself as Cephalus, with ransom notes observed publicly and in‑customer environments.
- Initial access in both incidents was via RDP using compromised accounts that lacked multi‑factor authentication (MFA).
- Attackers used MEGAcmd/MEGA (e.g., MEGAcmdUpdater.exe) consistent with probable data exfiltration prior to encryption.
- Ransomware deployment relied on DLL sideloading: SentinelBrowserNativeHost.exe (from Downloads) loaded SentinelAgentCore.dll which then loaded data.bin containing the ransomware code.
- Before encryption, the attackers ran commands to remove volume shadow copies (vssadmin delete shadows) and executed PowerShell and reg.exe commands to add Windows Defender exclusions and disable Defender services and real‑time protection.
- Ransom notes explicitly claimed “We’re Cephalus,” linked to news articles and provided a GoFile repository link/password to show stolen data as proof.
- One attempted deployment was blocked by Microsoft Defender; artifacts observed include SentinelBrowserNativeHost.exe and SentinelAgentCore.dll with provided SHA256 hashes.
MITRE Techniques
- [T1078] Valid Accounts – Initial access was achieved via Remote Desktop Protocol using compromised accounts lacking multi‑factor authentication (“Both incidents involved the use of Remote Desktop Protocol (RDP) via compromised accounts sans multi-factor authentication”).
- [T1190] Exploit Public-Facing Application – RDP access to exposed services implies exploitation of a public‑facing service to gain access (“Both incidents involved the use of Remote Desktop Protocol (RDP) via compromised accounts”).
- [T1020] Automated Exfiltration – Use of MEGA cloud storage for likely data exfiltration (“We also saw attackers use the MEGA cloud storage platform, presumably for data exfiltration”).
- [T1218] Signed Binary Proxy Execution – DLL sideloading via a legitimate SentinelOne executable: SentinelBrowserNativeHost.exe launched from Downloads loaded SentinelAgentCore.dll which then loaded data.bin (“SentinelBrowserNativeHost.exe, a legitimate SentinelOne executable, was launched from the user’s Downloads folder, which then loaded SentinelAgentCore.dll. From this, data.bin was subsequently loaded”).
- [T1490] Inhibit System Recovery – Deletion of shadow copies using vssadmin to prevent recovery (“vssadmin delete shadows /all /quiet”).
- [T1089] Disabling Security Tools – Registry modifications and PowerShell commands to add Defender exclusions and disable real‑time protection and services (“Add‑MpPreference -ExclusionPath …”, “reg add … DisableRealtimeMonitoring”, “Stop-Service -Name “WinDefend” -Force”).
- [T1486] Data Encrypted for Impact – Ransomware encrypted files and left ransom notes claiming theft and providing contact/verification links (“the ransom note starts off with the words “We’re Cephalus” … claim to have stolen “confidential data””).
Indicators of Compromise
- [File name] SentinelOne executable in Downloads – SentinelBrowserNativeHost.exe (launched from C:Users[user]Downloads)
- [File hash] SentinelOne executable SHA256 – SentinelBrowserNativeHost.exe SHA256: 0d9dfc113712054d8595b50975efd9c68f4cb8960eca010076b46d2fba3d2754
- [File name] DLL used to launch ransomware – SentinelAgentCore.dll (loaded by SentinelBrowserNativeHost.exe)
- [File hash] SentinelAgentCore.dll SHA256 – 82f5fb086d15a8079c79275c2d4a6152934e2dd61cc6a4976b492f74062773a7
- [File name] Ransomware payload container – data.bin – file containing the ransomware code (Huntress unable to collect a copy from endpoint)
- [File extension] Encrypted file extension – .sss (identified as Cephalus encrypted file extension)
- [File name] Ransom note filename – recover.txt (ransom note observed on impacted endpoints)
- [Process/command] MEGA command/process – MEGAcmdUpdater.exe command: C:Users[user]AppDataLocalMEGAcmdMEGAcmdUpdater.exe –normal-update –do-not-install –version 2010100
- [Host/path] Threat actor operations folder – C:Users[user]Downloads (SentinelBrowserNativeHost.exe present in Downloads folder)
Read more: https://www.huntress.com/blog/cephalus-ransomware